Follow-up triggers for MSP sales: certificates, domains and DMARC changes

Most deals with small businesses do not close on the first message. They close when the prospect has a reason to act and you happen to be the person who told them. A follow-up based on a real event is the most natural way to be that person. Here are six events you can detect from public data, and what to say for each.

1. The SSL certificate is about to expire

When: under 14 days left, and the certificate does not look automatically renewed (long-lived certificates from a paid CA are the usual case).

Say: "The security certificate on yoursite.com expires on the 14th. If your web host renews it automatically, ignore this. If not, visitors will see a browser warning from that date. Want me to check?"

Certificate lifetimes are shrinking every year, which makes this trigger more frequent. See SSL certificates are moving to 47 days.

2. The domain registration is close to expiry

When: under 30 days until the registration expires.

Say: "Your domain registration is due on the 3rd of next month. If auto-renew is on with a valid card, you're fine. If it lapses, email and the website can stop working." Explain the grace periods if they ask: what happens when a domain expires.

3. They changed mail provider

When: the MX records now point to a different provider, for example from a web host's mail to Microsoft 365.

Say: "Looks like you've moved email to Microsoft 365. That's usually when SPF and DKIM get left half done. Yours currently [specific finding]." This is one of the best openers there is, because migrations really do leave gaps and the timing shows you are paying attention.

4. The DMARC policy changed

Weakened (for example from reject to none): "Your DMARC policy changed this week from reject to none, which switches off spoofing protection. Sometimes that's deliberate while troubleshooting. Worth confirming it's temporary."

Strengthened: "Nice work moving to p=reject. One thing still open is [next finding]." Congratulating progress is a remarkably effective follow-up.

5. A new gap appeared

When: a new high or critical finding, such as HTTPS failing or a new SPF error after a tool was added.

Say: state the change in one sentence, say why it matters, and offer the fix. Keep severity honest. If it is minor, say so.

6. Something got fixed

If a prospect fixes a gap you pointed out, they did listen. Say thanks, confirm it is working, and mention the next most useful thing. It positions you as the person who notices, which is what they would be paying for.

How to watch for these events

Checking 50 prospects by hand every week is not realistic. Options:

• Calendar reminders from the expiry dates in each report. Simple, but you miss changes.
• A weekly re-check of your list in a bulk check, then sort by what changed.
• A watchlist: Hookgap rechecks watched domains every week and posts an alert to Slack, Teams or Discord when one of the events above happens. Watch rescans do not count toward your monthly reports.

Follow-up etiquette

• One follow-up per real event, not one per week.
• Never imply blame on their current provider.
• Stop immediately when someone asks you to.
• Keep each message as short as the first one. The cold email templates work for follow-ups too.